An application stores metadata about files in extended attributes. The administrator needs to set a custom attribute 'department' with value 'finance' on a file, but the attribute must be visible to any user who can read the file, not just root. Which command should be used?

setfattr -n user.department -v finance /path/to/file

setfattr -n security.department -v finance /path/to/file

setfattr -n system.department -v finance /path/to/file

setfattr -n trusted.department -v finance /path/to/file

A user reports they cannot access a file in a directory where they have been granted access via an ACL. The administrator runs getfacl on the file and sees the following output: # file: report.txt # owner: root # group: staff user::rw- user:alice:r-- group::r-- mask::r-- other::--- The user alice is trying to write to the file. What is the most likely reason the write is failing?

The file has the immutable attribute set.

The group staff does not have write permission.

The user alice is not the owner of the file.

The mask entry limits effective permissions to read-only for named users.

A developer needs to run a script that requires root privileges, but the administrator does not want to grant the developer sudo access. The script is owned by root and is executable. Which configuration allows the developer to run the script with root privileges?

chown root:developer /path/to/script

LPIC-3 Security

Domain 3Objective 1

327.1 Discretionary Access Control (weight: 3) LPIC-3-SECURITY Practice Questions (Page 3)

Part of the Topic 327: Access Control domain, which makes up ~19% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

Questions 11–15

11application · medium
An application stores metadata about files in extended attributes. The administrator needs to set a custom attribute 'department' with value 'finance' on a file, but the attribute must be visible to any user who can read the file, not just root. Which command should be used?
Select an answer first
12foundation · easy
Which extended attribute namespace is typically used for storing custom application data?
Select an answer first
13application · medium
A user reports they cannot access a file in a directory where they have been granted access via an ACL. The administrator runs getfacl on the file and sees the following output: # file: report.txt # owner: root # group: staff user::rw- user:alice:r-- group::r-- mask::r-- other::--- The user alice is trying to write to the file. What is the most likely reason the write is failing?
Select an answer first
14application · medium
A developer needs to run a script that requires root privileges, but the administrator does not want to grant the developer sudo access. The script is owned by root and is executable. Which configuration allows the developer to run the script with root privileges?
Select an answer first
15foundation · easy
Which attribute class is typically restricted to processes with CAP_SYS_ADMIN capability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

327.1 Discretionary Access Control (weight: 3) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

An application stores metadata about files in extended attributes. The administrator needs to set a custom attribute 'department' with value 'finance' on a file, but the attribute must be visible to any user who can read the file, not just root. Which command should be used?

Which extended attribute namespace is typically used for storing custom application data?

A developer needs to run a script that requires root privileges, but the administrator does not want to grant the developer sudo access. The script is owned by root and is executable. Which configuration allows the developer to run the script with root privileges?

Which attribute class is typically restricted to processes with CAP_SYS_ADMIN capability?

Keep studying — Topic 327: Access Control